TI-2026-18173 CVE-2026-22612 · GHSA-h4rm-mm56-xf63
Fickling vulnerable to detection bypass due to "builtins" blindness
Priority HIGH 80
Fickling is a Python pickling decompiler and static analyzer.
trailofbits
Records15All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high12CVSS 7.0–8.9
Exploited now
trailofbits records in CISA KEVNo trailofbits vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
9 records in Fickling · all components
TI-2026-18170 CVE-2026-22609 · GHSA-q5qq-mvfm-j35x
Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist
Priority HIGH 80
Fickling is a Python pickling decompiler and static analyzer.
TI-2026-18169 CVE-2026-22608 · GHSA-5hvc-6wx8-mvv4
Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection
Priority HIGH 80
Fickling is a Python pickling decompiler and static analyzer.
TI-2026-18168 CVE-2026-22607 · GHSA-p523-jq9w-64x9
Fickling Blocklist Bypass: cProfile.run()
Priority HIGH 80
Fickling is a Python pickling decompiler and static analyzer.
TI-2026-18167 CVE-2026-22606 · GHSA-wfq2-52f7-7qvj
Fickling has a bypass via runpy.run_path() and runpy.run_module()
Priority HIGH 80
Fickling is a Python pickling decompiler and static analyzer.
TI-2026-12265 CVE-2026-14535 · GHSA-mgx3-9w7v-8674
Fickling MLAllowlist analysis pass rendered inoperative by shared mutable state in AnalysisContext.shorten_code()
Priority HIGH 76
In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardless of whether the import…
TI-2026-12264 CVE-2026-14534 · GHSA-v8cr-9jrc-fwf9
Fickling check_safety() bypass via unlisted standard library modules (_posixsubprocess, site, atexit)
Priority HIGH 73
Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py).
TI-2025-41444 CVE-2025-67748 · GHSA-r7v6-mfhq-g3m2
Fickling has Code Injection vulnerability via pty.spawn()
Priority HIGH 66
Fickling is a Python pickling decompiler and static analyzer.
TI-2025-41443 CVE-2025-67747 · GHSA-565g-hwwr-4pp3
Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list
Priority HIGH 66
Fickling is a Python pickling decompiler and static analyzer.